EUVD-2026-75520
GHSA-jvx8-x3r9-3xqq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-reachable unauthenticated bypass with no scope change; impacts limited to plugin integrity and availability, no confidentiality loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.
AnalysisAI
Broken authentication in IMPress for IDX Broker WordPress plugin (versions ≤ 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (PR:N, AV:N, AC:L) confirms exploitation requires no credentials and no user interaction against default plugin configurations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required; the vulnerability is exploitable by any party with network access to the target WordPress site's HTTP/HTTPS interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 base score is supported by a network-accessible, zero-prerequisite attack vector (AV:N/AC:L/PR:N/UI:N), which raises operational concern for any internet-facing WordPress site running this plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - site owners should update IMPress for IDX Broker to the version immediately following 3.3.0 via the WordPress plugin dashboard or WP-CLI (wp plugin update idx-broker-platinum); an exact fixed release version is not independently confirmed from available data, so verify the current release in the WordPress plugin repository before applying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Impress For Idx Broker
View allAn issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. Rated medium severity (CVSS 6.5
Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subs
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress
Broken access control in the IMPress for IDX Broker WordPress plugin (versions <= 3.3.0) allows authenticated subscriber
Share
External POC / Exploit Code
Leaving vuln.today